Uber’s €825M GDPR Fine: Algorithms Can’t Fire People Alone

The Dutch Data Protection Authority just fined Uber €825 million — nearly $1 billion — for letting algorithms suspend driver accounts without human review. It is the second-largest GDPR penalty in history, and if you’re shipping any automated system that makes decisions about people’s income or access, you should read this carefully.

What Uber Actually Did

Between 2020 and 2022, Uber’s fraud detection systems flagged and suspended driver accounts entirely on their own. The triggers included unnecessary detours to inflate fares, low customer ratings, incomplete trips, and geolocation checks that suggested account-sharing. When a driver got flagged, the algorithm acted. No human reviewed the case individually. No explanation was given. And in many cases, there was no clear path to appeal.

For a driver, suspension isn’t an inconvenience — it’s a loss of income. That distinction is exactly why GDPR treats it so seriously.

The Law Uber Broke (And It Is Straightforward)

GDPR Article 22 gives individuals the right not to be subject to decisions made entirely by automated processing when those decisions carry significant effects — legal, financial, or otherwise. Losing your ability to work on a platform you depend on is about as significant as it gets.

The law allows automated decisions under specific conditions, but three safeguards are always mandatory: real human review (with actual authority to override, not just sign off), the ability to express a point of view, and the right to contest the outcome. The EU’s top court confirmed in 2023 that a rubber-stamp human approval doesn’t satisfy this requirement — the reviewer must be able to genuinely reconsider the decision.

Uber’s system had none of that. The Dutch regulator found violations, the fine followed, and Uber is now appealing while claiming its current processes are different.

This Is Not Just Uber’s Problem

Gig platforms are the obvious target here, but the exposure is much wider than Uber. The same legal logic applies to any automated pipeline that makes consequential decisions about individuals:

• Resume-screening tools that reject candidates
• Content moderation systems that remove accounts
• Credit-scoring algorithms that deny applications
• HR software that flags performance or recommends termination
• Insurance underwriting that sets premiums or declines coverage

If your system produces a decision with significant effects on a person — and it does so automatically — you are in scope of GDPR Article 22. The EU AI Act adds another layer: high-risk AI systems in employment and essential services must have human oversight baked in at the architecture level, not patched in later.

What Developers Should Do Now

Most teams don’t build automated suspension systems expecting a $1 billion fine. They want speed, scale, and operational efficiency. Those are legitimate goals. The problem is designing the human out of the loop entirely for decisions that carry real stakes.

A practical audit of your automated decision systems:

1. Map the decision points — Which pipelines produce outputs that affect users directly? Account status, access, financial decisions, content removal?
2. Rate the stakes — Does the output affect income, employment, credit, or access to essential services? Higher stakes mean stricter requirements.
3. Add real oversight — Not a button that auto-approves the algorithm’s output, but a review queue where a human can see the evidence and override the decision.
4. Build an appeal path — Users must be able to contest automated decisions and get a genuine human review, not an automated response.
5. Document the logic — Audit trails for what the algorithm decided and why are essential for regulatory inquiries and for your own debugging.
6. Run a DPIA — A Data Protection Impact Assessment is required for high-risk automated processing. It forces you to think through risks before deployment.

The fine isn’t for using automation. It’s for using automation without accountability. Those are different things, and the distinction is worth engineering time.

The Bigger Picture

GDPR enforcement has collected €6.31 billion in total fines since 2018. Uber’s €825 million represents more than 13 percent of that total. The list of major fines keeps growing, and the trend is clearly toward larger penalties for AI-driven violations.

Human Rights Watch noted earlier this year that AI already runs the gig economy — setting pay, assigning tasks, monitoring performance, and deciding who gets to keep working. Regulators have noticed. The ILO has called for workers globally to have the right to request human intervention in automated employment decisions. US states are writing similar bills.

Uber’s appeal may reduce the fine. It won’t change the underlying requirement: for decisions that carry real consequences for real people, the loop needs a human in it. That requirement isn’t going away — it’s getting stricter.